Note that there is no restriction on using “../” in the “aam_configpress” option so depending on server configuration you could create files anywhere on the filesystem.
This attack could be scripted to allow upload of binary files, including executable files.